gitea: update to version 1.24.7
This includes a number of security fixes over the last version packaged,
1.23.8:
* Upgrade xz to v0.5.15 (#35385)
* Refactor legacy code, fix LFS auth bypass, fix symlink bypass (#35708)
(#35713)
* Fix password leak in log messages (#35584) (#35665)
* Fix a missed return in OAuth2 (#35655) (#35671)
Breaking changes are:
* Make Gitea always use its internal config, ignore /etc/gitconfig
(#33076)
* Improve log format (#33814)
* Fix markdown render behaviors (#34122)
* Add package version api endpoints (#34173)
[4 lines not shown]
pkgtools/pkglint: update to 23.20.0
Changes since 23.19.0 from 2025-08-15:
Warn on the condition "empty(${EXPR})" in .if directives, as typically
"empty(EXPR)" is intended.
Do not warn when a plain command "echo" or "printf" is not hidden, as
these commands are typically uninteresting.
Allow patch files to have abbreviated names. Previously, the only valid
names were the full path or the basename, now each possible suffix path
is valid.
Explain when and why the ":M*" modifier is necessary.
For GCC_REQD, allow only major versions such as 4.8 or 8 or 15.
Allow distinfo files with variant names, like distinfo-binutils or
distinfo-linux.
print/qpdf: Update to 12.3.2
Changelog:
12.3.2: January 24, 2026
Bug fixes
* Fix bug introduced in 12.3.0. If the --password was
specified for the same file multiple times a usage
error was thrown. Specifying the password multiple
times is common within the --pages option when using
the QPDFJob interface.
Import Jiaxun Yang's bochsfb(4) driver.
This is useful for getting graphics on qemu-system-aarch64 without
firmware runtime video support (e.g. using the -kernel option). At the
moment it is only wired up for -device VGA and -device secondary-vga
so that it doesn't conflict with viogpu.
PR kern/59410
misc/libreoffice: Fix build with converters/orcus-0.21.0
* And use security/gpgmepp for gpgme c++ support.
* Bump PKGREVISION because of new filename of orcus and dependency change.
Update to 2.20
Upstream changes:
2.20 2025-10-22 19:04:44Z
[ENHANCEMENTS]
- WWW::Mechanize no longer taints the responses it receives. This also
removes Test::Taint as a prerequisite. (GH#383) (Andy Lester)
- select() now accepts a number argument to specify which instance of an
element with multiple occurrences to use (GH#189) (Julien Fiegehenn)
- Add Bash completion (GH#396) (Mikko Koivunalho)
[DOCUMENTATION]
- Improve FAQ (GH#76) (Julien Fiegehenn)
- Add installation instructions and badge for Repology (GH#399) (Mikko
Koivunalho)
- Add License, CPAN and kwalitee badges to README (GH#400) (Mikko
Koivunalho)
[FIXED]
- Fix test failure after release of HTTP::Message 7.01 (GH#403) (Olaf
Alders)
[5 lines not shown]
Import Mojolicious-Plugin-CSRF-1.05 as www/p5-Mojolicious-Plugin-CSRF.
This module is a Mojolicious plugin for Cross Site Request Forgery (CSRF)
"prevention" (theoretically; if used correctly; caveat emptor).
By default, when used, the plugin will cause requests methods that
traditionally contain data-changing actions (i.e. POST, PUT, etc.) to
check a generated session token against a token from a form value, URL
parameter, or HTTP header. On failure, a Mojo::Exception is thrown.
Import Test2-MojoX-0.07 as www/p5-Test2-MojoX.
Test2::MojoX is a test user agent based on Mojo::UserAgent, it is
usually used together with Test2::Suite to test Mojolicious
applications. Just run your tests with prove or yath.